Privacy

Who we are

Shema Studio (https://www.shemastudio.co) is the data controller for the personal data described in this policy. For any privacy question or request, contact info@shemastudio.co.

What we collect, and why

We collect as little as the task requires. In practice, that is:

• Contact and Consent Scan form submissions. Name, work email, company, website URL, company size (optional), and whatever you write in the message field. Used only to respond to your request or deliver the scan report, nothing else. We do not build a mailing list from it.
• Consent choice.Whether you accepted or declined analytics, stored in your browser’s local storage, not sent to us or any server. See the Cookies page for detail.
• Analytics, only if you accept it.If you grant analytics consent, Google Tag Manager loads and standard web analytics may be collected from that point on, governed by Google’s own privacy terms. Nothing loads before that choice.

How submissions are handled

Form submissions are emailed to our inbox and, where enabled, mirrored to an internal Slack channel. We do not store submissions in a database. Requests are rate limited and checked for automated (bot) submission before being processed; legitimate submissions are never rejected for this.

Who else sees it

We do not sell personal data. It is shared only with the infrastructure needed to run the site and respond to you:

• Vercel (hosting), which serves every page and, as a normal part of running a web server, briefly processes visitor IP addresses for routing and abuse prevention. This happens regardless of your cookie choice, on the same legitimate-interest basis any host needs to keep a service running and secure.
• Resend (email delivery), which sends the message when you submit the Contact or Consent Scan form.
• Google (Tag Manager / Analytics), only if you grant analytics consent.

Vercel, Resend, and Google are US-based providers, so using this site involves transferring data outside the EEA/UK to them. Each operates under the EU Standard Contractual Clauses (or an equivalent recognised transfer mechanism) as their lawful basis for that transfer. No other third party receives your data.

How long we keep it

Form submissions live in our email inbox for as long as the engagement or enquiry is relevant, and in any case no longer than 24 months from your last contact with us, after which they are deleted. Hosting-level request logs (IP address, timestamp, requested page) are retained by Vercel only briefly, for operational and security purposes, and are not exported into any database we maintain. We keep no marketing or CRM database of visitors or leads at launch.

Your rights

If you are in the EU, UK, or a jurisdiction with equivalent protections, you can ask us to access, correct, delete, or export the personal data we hold about you, and you can object to how it is used. Contact info@shemastudio.co to exercise any of these. You can also lodge a complaint with your local data protection authority.

Changes to this policy

If this policy changes materially, we will update the date at the top of this page.